Added RICH header IDs for VS 16.4.4 comoiler.

JusticeRage · Feb 1, 2020 · 344a1eb · 344a1eb
1 parent 69be7c7
commit 344a1eb
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/bin/yara_rules/suspicious_strings.yara b/bin/yara_rules/suspicious_strings.yara
@@ -575,7 +575,7 @@ rule VMWare_Detection : AntiVM
 {
     meta:
         description = "Looks for VMWare presence"
-        author = "Cuckoo project"
+        author = "Cuckoo project + @JusticeRage additions"
 
     strings:
         $a0 = { BA 58 56 00 00 ED 81 FB 68 58 4D 56 } // mov edx, 'VX'; in eax, dx; cmp ebx, 'VMXh'

diff --git a/manape/nt_values.cpp b/manape/nt_values.cpp
@@ -683,6 +683,7 @@ const flag_dict COMP_ID_PRODID =
                                 ("VS2019 Update 4 (16.4.?) compiler 28117",    0x6DD5)
                                 ("VS2019 Update 4 (16.4.0-2) compiler 28314",  0x6E9A)
                                 ("VS2019 Update 4 (16.4.3) compiler 28315",    0x6E9B)
+                                ("VS2019 Update 4 (16.4.4) compiler 28316",    0x6E9C)
     ;
 
 // ----------------------------------------------------------------------------